About
Follow me for system design & book-writing tips.
Alex Xu is a software engineer…
Alex Xu is a software engineer…
Articles by Alex
Activity
1M followers
-
Alex Xu shared thisHow Docker Works Under the Hood A Docker container starts with a single command, but that command has to be turned into a running Linux process. Here is what actually happens. The Docker CLI takes your command and sends it as an API call to the Docker daemon (dockerd) running on the host. dockerd checks whether the nginx image is already on disk. If it is not, it pulls it from a registry like Docker Hub or ECR. Then it prepares the container config. dockerd does not start the container directly. It passes the request to containerd, which manages the container lifecycle. containerd prepares the runtime files and assembles a bundle made of the OCI config and the root filesystem. containerd then calls runc. runc reads the bundle, creates the Linux namespaces and mounts defined in the config, and starts the process inside them. Once the process is running, runc exits. The running container is a regular Linux process with its own PID, network, and mount namespaces. Its filesystem is a stack of read-only image layers with a writable layer on top, so changes inside the container do not modify the image. Isolation comes from kernel features. Namespaces separate processes, cgroups limit CPU and memory, and network namespaces give the container its own interfaces. There is no guest OS and no hypervisor. Over to you: where do most of your container issues show up, the image, networking, or resource limits? -- Subscribe to our weekly newsletter to get a Free System Design PDF (368 pages): https://lnkd.in/gF7Vsw6X #systemdesign #coding #interviewtips .
-
Alex Xu shared thisMost Common Types of Cyber Attacks Malware-Based Attacks: These attacks rely on malicious software to infect, steal, or disrupt. - Virus: infects files and spreads when those files are executed. - Worm: self-replicates across networks without user interaction. - Trojan Horse: disguises itself as legitimate software to gain access. - Ransomware: encrypts data and demands payment for decryption. - Spyware: covertly tracks user actions, keystrokes, and sensitive data. Network Attacks: These target communication channels or network infrastructure. - DDoS: floods servers with traffic, causing downtime. - Man-in-the-Middle: intercepts and alters communication between two parties. - DNS Spoofing: manipulates DNS responses to redirect users to malicious sites. Web Application Attacks: Focused on vulnerabilities in web apps or APIs. - SQL Injection: injects malicious queries to access or manipulate databases. - Cross-Site Scripting (XSS): injects scripts into webpages to run in users’ browsers. - API Exploits: target insecure or exposed API endpoints. Identity Attacks: Designed to take over accounts or impersonate users. - Brute Force Attack: automated password-guessing attempts. - Session Hijacking: steals session tokens to act as a logged-in user. Social Engineering Attacks: These exploit human behavior, not systems. - Phishing: tricks users into revealing sensitive information. - Deepfake: uses AI-generated voice or video to impersonate people convincingly. Over to you: Which type of cyber attack do you see most often in real-world incidents today? -- Subscribe to our weekly newsletter to get a Free System Design PDF (368 pages): https://lnkd.in/gF7Vsw6X #systemdesign #coding #interviewtips .
-
Alex Xu shared thisDesign Patterns Cheat Sheet The cheat sheet briefly explains each pattern and how to use it. What's included? - Factory - Builder - Prototype - Singleton - Chain of Responsibility - And many more! – Like this post and subscribe to our newsletter to receive both part 1 and part 2 of the cheat sheet link: https://lnkd.in/eeGDwh88 #systemdesign #coding #interviewtips .
-
Alex Xu shared thisAPI Security Best Practices Most API breaches happen because of broken authorization, leaked secrets, or missing rate limits. Let's look at some of the basics. - Use Modern OAuth/OIDC + MFA: PKCE for public clients, short-lived tokens, and step-up MFA for anything sensitive. Implicit and password grants should be dead by now. - Enforce Fine-Grained Authorization: Check object, function, and field-level permissions on every request. BOLA is still the top API vulnerability. - Minimize Scopes and Data: Give each client the smallest token scope and the least data it needs. Only return the fields the caller actually needs. - Encrypt Every Hop: TLS for external traffic and mTLS between services. If it crosses a network boundary, encrypt it. - Protect Secrets and Keys: Store signing keys in HSM-backed vaults. Rotate them. - Validate Requests with Schemas: Reject unknown fields, oversized payloads, and suspicious URLs at the gateway. Don't let bad input reach your business logic. - Rate Limit and Cap Resources: Quotas per user, payload size caps, and execution timeouts. Without these, one misbehaving client takes down your entire system. - Defend Sensitive Business Flows: Protect login, checkout, and OTP with anti-bot, idempotency keys, and step-up auth. - Control Outbound and Third-Party Calls: Allowlist where your API can call out to and block internal metadata endpoints. Your security is only as strong as your weakest integration. - Harden Config and Error Handling: Deny by default on CORS, methods, and debug endpoints. Return generic errors, never stack traces. - Inventory APIs and Versions: Track every endpoint, version, and shadow API. You can't secure what you don't know exists. - Log, Detect, and Respond: Push auth decisions and anomalies to a SIEM. Alert on 401 spikes before they become incidents. Over to you: Which of these best practices is the hardest to enforce across your services? -- Subscribe to our weekly newsletter to get a Free System Design PDF (368 pages): https://lnkd.in/gF7Vsw6X #systemdesign #coding #interviewtips .
-
Alex Xu shared thisRAG vs Graph RAG vs Agentic RAG RAG connects LLMs to your data and there are three different ways to do it. Standard RAG - The query is converted into an embedding and matched against a vector database. - The top-K closest chunks are pulled out and passed to the LLM as context. - The LLM writes a grounded answer using only what was retrieved. Graph RAG - The query is classified: specific questions route to local search, broad questions route to global search. - Local search: query embedded → vector DB finds matching entities → pipeline traverses across the knowledge graph collecting linked context → LLM synthesis final answer. - Global search: no vector search, no graph traversal → community reports loaded in batches → LLM scores each for relevance → top-ranked context → LLM synthesizes final response. Agentic RAG - A reasoning agent reads the query, breaks it into sub-questions and picks the sources. - The context across multiple sources is retrieved, depending on the sub-query. - Another agent checks whether the retrieved context answers the question. If not, it re-retrieves. - Once satisfied, the final answer is synthesized by LLM based on the prompt. Standard RAG is fast and cheap but if the wrong chunk is retrieved, the answer is wrong and nothing catches it.Use it when the answer lives in your documents and speed matters. Graph RAG is expensive to build and slow to update. Use it for structured knowledge like legal, compliance, or biomedical data. Agentic RAG is more capable and flexible but slower, expensive, and harder to debug. Use it when the question needs multi-step reasoning and self-correction. Over to you: Which of these are you running in production? -- Subscribe to our weekly newsletter to get a Free System Design PDF (368 pages): https://lnkd.in/gF7Vsw6X #systemdesign #coding #interviewtips .
-
Alex Xu shared thisAn Ex-Meta L8’s Agentic Engineering Setup In this guest article, Kun Chen shares the agentic engineering workflow he uses on a day-to-day basis. Read the full article here: https://lnkd.in/g2nGAN3a
-
Alex Xu shared thisRedis Data Structures Every Engineer Should Know - Strings store one value per key. They work for counters, session tokens, and cached payloads. - Hashes store an object's fields under one key. You can update one field without rewriting the rest. - Lists are ordered sequences with fast push and pop at both ends. They fit queues, feeds, and recent-item lists. - Sets hold unique members and support intersection, union, and difference. They cover tagging, follower overlap, and deduplication. - Sorted Sets rank members by a numeric score. They handle leaderboards, priority queues, and top-N or range-by-score queries. - Streams are an append-only log with consumer groups. Each consumer tracks its own position, and the server tracks unacknowledged messages. - JSON stores nested documents with JSONPath access. You can update a field deep in a document without read-modify-write. - Geospatial provides latitude/longitude indexes with radius and box queries. Under the hood it's a Sorted Set with geohash scores. - Vector Set runs approximate nearest-neighbor search over embeddings. It's the retrieval step in most RAG pipelines. - Time Series stores timestamped samples with built-in retention, downsampling, and labels. It fits metrics, telemetry, and IoT data. Over to you: All ten are built-in as of Redis 8. Which one do you use most outside of caching? -- Subscribe to our weekly newsletter to get a Free System Design PDF (368 pages): https://lnkd.in/gF7Vsw6X #systemdesign #coding #interviewtips .
-
Alex Xu shared thisSingle Agent vs. Multi-Agent Architecture Some tasks need a single agent. Others need a whole team. Knowing the difference is the skill. Single-agent system: One reasoning LLM that plans, picks a tool, and loops on its own until the task is done. Use a single agent when: - the task is a clear, linear sequence - one agent can hold the whole problem in its head - you want something simple to build and easy to debug Multi-agent system: An orchestrator that splits a task into subtasks and routes each one to a specialized agent. Use multi-agent when: - subtasks can run in parallel - one agent writes and another independently verifies the work - the problem is too big for one agent to coordinate alone Single agents are cheaper and easier to build, but they hit a ceiling on complex work. Multi-agent systems are more capable and more reliable, but they add coordination cost. Start with a single agent. Move to multi-agent only when context or reliability become the bottleneck. Over to you: Are you running single-agent or multi-agent systems in production? -- Subscribe to our weekly newsletter to get a Free System Design PDF (368 pages): https://lnkd.in/gF7Vsw6X #systemdesign #coding #interviewtips .
-
Alex Xu shared thisTwelve models worth knowing in 2026, each with one standout strength. 1. Llama 4 Scout: Meta's first natively multimodal open-weight model. 2. DeepSeek V4: A Mixture-of-Experts model under MIT license with a native million-token context window. Near-frontier performance at a fraction of the cost per token. 3. Qwen3: Alibaba's flagship open-weight model with switchable thinking and non-thinking modes, all under Apache 2.0. 4. Gemma 4: Google's open-weight family released under Apache 2.0, with the widest language coverage of any model on this list. 5. Phi 4: Microsoft’s compact model trained almost entirely on synthetic, curated data. A practical choice for edge and on-device deployment. 6. Mistral Small 3.1: A VLM with a long context window that fits on a consumer laptop. 7. Nemotron 3 Super: NVIDIA’s hybrid MoE with a million-token context window. Fully open weights, datasets, and recipes, with strong results on agentic coding benchmarks. 8. GLM 5.1: The first open-weight model to top SWE-Bench Pro. Released under MIT with no commercial restrictions. 9. Kimi K2.6: Competitive with leading closed models on coding while costing far less per million tokens. Available on Hugging Face under a Modified MIT license. 10. StarCoder2: One of the most transparent code models available. 11. OLMo 2 (AI2): The most complete example of open-source reproducibility on this list. Weights, training data, code, and full recipes all released under Apache 2.0. 12. Falcon 3: A family of lightweight open-weight models built to run on a single GPU. Over to you: which open-source model would you add to this list? -- Subscribe to our weekly newsletter to get a Free System Design PDF (368 pages): https://lnkd.in/gF7Vsw6X #systemdesign #coding #interviewtips .
Alex Xu commented on a post
2w
Great chatting with you, John! Your point about flipping the 90/10 work structure post-launch is one every team building agents should hear.
Alex Xu commented on a post
3w
Congrats, Peiheng H.! The book looks fascinating. I just placed my order and can't wait to dive in.
-
Alex Xu liked thisAlex Xu liked thisCompanies are scaling to thousands of custom agents that call tools and each other. But most of those calls happen directly, with no verified identity and no authorization check. Instead, each agent should have its own identity, a short-lived, attested credential rather than a static API key. When it's acting for a user or another agent, its identity should say so. An agent gateway enforces this. Every call routes through the gateway, and before it reaches a tool or another agent, that endpoint verifies the agent's identity, uses it to authorize which tools (MCPs, APIs, CLIs) and other agents (A2A) the agent can reach, and audits the call. Every action then traces back to the user who triggered it, and no agent can exceed the permissions of whoever it's acting for. And there are already strong open source and vendor options, so you don't need to build this yourself.
-
Alex Xu liked thisAlex Xu liked thisA year and a half, countless experiments, and hundreds of pages later... today was one of my favorite days as an engineer and author. Build a Reasoning Model (From Scratch) is finally out, and my first copies just arrived! 440 full-color pages. A huge thank you to everyone who joined me as an early reader and reviewer over the past 1.5 years. I hope this is a worthy sequel to Build a Large Language Model (From Scratch). If you are wondering what's it covers, it walks you through implementing modern reasoning techniques from scratch on top of a small Qwen3 base model, with a focus on: • inference scaling • reinforcement learning • distillation While Build a Large Language Model (From Scratch) focuses on building and pre-training an LLM, this book picks up where that one leaves off and covers what comes next. (If you enjoy model architecture details, don't worry, the complete Qwen3 architecture is also implemented from scratch and explained in the appendix.) The book is now shipping from the publisher: https://mng.bz/Nwr7 And it's also available for preorder on Amazon (shipping expected to begin there in a few weeks): https://amzn.to/4aAKiFY I hope it serves as a useful resource for anyone who wants to understand how reasoning models, which are now a key component of many modern AI agents, work under the hood. Thanks again to everyone who helped make this book possible! Happy reading!
-
Alex Xu liked thisAlex Xu liked thisI started my AI Engineering journey early this year, and two of the ByteByteGo courses ended up being a big part of setting the right base for me. "Become an AI Engineer" gave me a solid grounding across the full stack — LLM training (pre-training, SFT, RLHF), prompt and context engineering, evals, RAG pipelines that actually hold up in production, and multi-agent design with tool use and MCP. Real world implementation: I was able to apply these learnings in building a feature that can give insights into billing to the customer which is today in production as pilot. "Build with Claude Code" was the one that genuinely changed how I work day-to-day. Context engineering with CLAUDE.md and memory layers, agentic automation with skills and MCPs, and multi-agent orchestration with parallel agent teams — all of it sharpened habits I'd already picked up the hard way while running my own multi-agent Claude Code setup. Real world implementation: This course helped me build a dynatrace auto-RCA analysis agent using n8n and Claude which reduces MTTR in production by 50%. Huge shout-out to Ali Aminian, @John K. , and Alex Xu for organizing these cohort based learning sessions, enabling the community to learn and build together. If you're looking to kick-start your structured learning journey into AI engineering, I would highly recommend these courses. #AIEngineering #ClaudeCode #AgenticAI #ByteByteGo #LLM #GenAI #MultiAgentSystems #PromptEngineering #RAG #MCP #AIEngineer #TechLearning
-
Alex Xu liked thisAlex Xu liked thisExcited to share that I’ve completed the Build with Claude Code cohort by ByteByteGo! 🎉 A big thank you to John K. and the ByteByteGo team for an excellent hands-on course. I particularly enjoyed learning practical AI engineering concepts like context engineering, MCP, Claude Code workflows, agentic development, and building production-ready AI applications. Looking forward to applying these learnings in enterprise solution architecture. #ClaudeCode #ByteByteGo #AIEngineering #AgenticAI #SolutionArchitecture #ContinuousLearning
-
Alex Xu liked thisAlex Xu liked thisAt Coinbase our AI spend is down nearly half this quarter while token usage keeps climbing. My team built the infrastructure behind it: routing, caching, cheaper defaults, and the spend services that track it. We route everything through our own gateway: a single endpoint and format for dozens of models, with cross-provider failover, redaction, logging, and cost controls all applied before anything reaches a vendor. We started with cheaper defaults and caching. 91% of employees weren't hitting their usage caps. Instead of lowering caps, we set cheaper model defaults to cut spend. Caching took more work to get consistent across every tool and model family. A cache hit needs the prefix to match exactly, so we keep building a long, stable prefix across turns. Each request only pays full rate on the new tokens and reads the rest from cache. Our routing accounts for caching too. The naive approach scores each turn on its own and sends it to whichever model fits, which seems reasonable but would run up spend. The cache is per-model, so switching mid-conversation invalidates it. Our router weighs cache state alongside how hard the task is: a conversation keeps its model while the cache is warm, and the chance to re-route comes only when it goes quiet long enough for the TTL to lapse. Once it does, the router is free again to pick the best model for the task. These improvements happened at the gateway, so they apply across every team and tool. Next we're going deeper on the coding harness, where we have the most signal and flexibility, tuning how subagents and context get managed.
-
Alex Xu liked thisAlex Xu liked thisA big thank you to Ali Aminian, John K. and Alex Xu. 🙏 I started my AI Engineering journey late last year, and two of the ByteByteGo courses have been a big part of setting the right base for me. "Become an AI Engineer" with Ali Aminian — a proper grounding in the full stack: LLM training (pre-training, SFT, RLHF), prompt and context engineering, evals, RAG pipelines that actually hold up, and multi-agent design with tool use and MCP. "Build with Claude Code" with John K. — the one that changed how I work day-to-day. Context engineering with CLAUDE.md and memory layers, agentic automation with skills and MCPs, and multi-agent orchestration with parallel agent teams. Honestly, it's been a great experience and has genuinely helped me move forward with confidence. As someone already running a multi-agent Claude Code setup, it sharpened a lot of habits I'd picked up the hard way. If you're looking to get into AI engineering, I can't recommend these enough. Worth every minute. #AIEngineering #ClaudeCode #AgenticAI #ByteByteGo
-
Alex Xu liked thisAlex Xu liked thisJ’ai compris une chose après 10 entrevues techniques : Les Big Tech ne recrutent pas juste des gens qui savent coder. Elles cherchent des gens capables de penser clairement sous pression. Quand on parle de Google, Amazon, Microsoft, Meta ou même de startups très techniques, beaucoup pensent directement au CV, au diplôme, au nombre d’années d’expérience ou aux technologies maîtrisées. Mais en entrevue, deux sujets reviennent très souvent : 1. Algorithmes & structures de données (Afshine Amidi & Shervine Amidi) Pas seulement pour résoudre des exercices. Mais pour voir comment tu réfléchis face à un problème flou, comment tu structures ta logique, comment tu expliques ton raisonnement et comment tu optimises ta solution. 2. System Design (Alex Xu) Parce qu’à un certain niveau, savoir coder ne suffit plus. Il faut être capable de designer un système qui peut gérer 1 million, 10 millions ou 100 millions de requêtes. Il faut penser scalabilité, latence, caching, bases de données, files de messages, microservices, résilience, coût et compromis techniques. Et plus j’avance dans mon parcours en software engineering et en IA, plus je réalise une chose : Les frameworks changent. Les outils changent. Les modèles d’IA évoluent très vite. Mais les fondamentaux restent. Savoir résoudre un problème. Savoir structurer sa pensée. Savoir expliquer ses choix. Savoir construire un système fiable. Savoir faire des compromis intelligents. C’est souvent ça qui fait la différence. Ces deux livres représentent exactement les deux piliers que je recommande à toute personne qui veut progresser sérieusement en tech : Algorithms & Data Structures pour muscler sa logique. System Design Interview pour apprendre à penser à l’échelle. Parce qu’au final, en entrevue technique, on ne cherche pas seulement quelqu’un qui sait utiliser un outil. On cherche quelqu’un qui sait penser. Selon vous, quelle compétence est la plus difficile à maîtriser : les algorithmes ou le system design ?
Experience & Education
-
ByteByteGo
View Alex’s full experience
See their title, tenure and more.
or
Publications
Other similar profiles
Explore more posts
-
Rubén Domínguez Ibar
🚨 JUST IN: Synthesia is now reportedly raising a new funding round at a $3B valuation, with Nvidia’s Jensen Huang among the investors In the past year Synthesia has ▫️ Raised $180M at a $2.1B valuation ▫️ Crossed $100M in ARR ▫️ Signed $1.1M ARR in a single day this summer Guillermo Flor and I sat down in London with Victor Riparbelli, Synthesia’s CEO, to talk about how he built a $2.1B AI video company from scratch before “generative AI” was even a term The result was one of the most insightful founder conversations I’ve ever had: 1️⃣ How he started building AI before ChatGPT → https://lnkd.in/ddqFUv8X 2️⃣ Why raising the first two rounds was almost impossible → https://lnkd.in/dEbvypjQ 3️⃣ Why VCs didn’t want to fund Synthesia → https://lnkd.in/dDp-fT47 4️⃣ How they found product-market fit after 3 years → https://lnkd.in/dbyNegCW 5️⃣ How Mark Cuban invested $1M and saved the company → https://lnkd.in/dzNe2qka 6️⃣ Where the real AI opportunity is → https://lnkd.in/dxs8UDFf 7️⃣ The difference between building in Europe vs the US → https://lnkd.in/dR_qy-gs 8️⃣ Why “Project Europe” by Harry Stebbings matters for the next generation of founders → https://lnkd.in/dACBHz_t 🔥 Share this to push Europe’s startup momentum forward what european startup will be the next Synthesia/Lovable/Spotify?
75 Comments -
Kadir Tas
The Token Imperative: Jensen Huang’s Vision for a Fully Digitized Cosmos At GTC 2025, Jensen Huang distilled the AI revolution into a single, universal principle: “Everything we can tokenize, AI can understand.” In Huang’s framing, tokenization is no longer a linguistic mechanism—it is the atomic unit of a fully digitized world. Once text, images, audio, sensor data, and even robotic motion are reduced to numerical primitives, AI can fuse them, translate them, simulate them, and ultimately generate new realities from them. This shift redefines multimodality as a unifying computational fabric. NVIDIA’s newly unveiled Cosmos platform exemplifies this paradigm: a foundation world model trained on massive video corpora, capable of predicting physical interactions and enabling robots to reason about consequences before acting. Tokenizing physics itself transforms autonomy from handcrafted logic into generative emergence. The implications are vast. Healthcare becomes predictive by tokenizing scans and genomes; industrial robotics gain agility through tokenized trajectories; and agentic AI—powered by the Blackwell architecture—begins to plan across modalities rather than merely respond. Huang’s live demos, including Project GR00T learning from tokenized human motion, signaled a decisive step toward bridging the sim-to-real gap that has constrained robotics for decades. Across Huang’s 2025 commentary—from CNBC interviews to Supercomputing 2025—this vision coheres into a grand thesis: the next technological revolution will be “physical AI,” built on systems that understand and interact with the world through tokenized sensory fusion. And with exascale “AI factories” emerging through DGX Cloud, the infrastructure for this transformation is already materializing. Huang’s message is clear: tokenization is not a feature—it’s the foundation. By rendering the analog world digitally native, AI shifts from mimicking intelligence to manifesting it. The future of computation is being generated, one token at a time. #Tokenization #JensenHuang #PhysicalAI #NVIDIAGTC #AITransformation
-
Alisar Mustafa
Universal Music Group Announces Global AI Policy Prioritizing Artist Rights and Responsible Use ▶ UMG CEO Sir Lucian Grainge shared a new AI policy built on three key principles: AI partnerships, artist participation, and responsible training. ▶ The company is working with partners including YouTube, TikTok, Meta, BandLab, SoundLabs, ProRata, Klay, and KDDI in Japan to develop AI tools for fan engagement. ▶ UMG stated it will only license its artists’ vocals or songs to AI models with explicit artist consent and proper licensing. ▶ “We will not license any model that uses an artist’s voice or existing songs without their consent,” Grainge said. ▶ UMG has filed lawsuits against AI music generators Suno and Udio for allegedly training on copyrighted material without permission. ▶ The company also partnered with SoundPatrol to detect when copyrighted works are used in AI training without authorization. ▶ UMG supports “market-based solutions” that promote collaboration between artists, music companies, and tech developers. ▶ The label says responsible AI development will allow both human creativity and technology to thrive together. 🔗 Link to article: https://lnkd.in/eyCndhth 📚 The AI Policy Newsletter: https://lnkd.in/eS8bHrvG
3 Comments
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content